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SenderV Mobile Phone. „ 

SenderVHome Phone _ _ „ _ 

"Serdef'<«^Phone.., 
Sender's Pager Pin 

Sender 1 * Pager *todem Nunher . 
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SO rf> 

soIwp ■ 

SO_pGR 

50_Fex 
50 PPCI 

sojoi .„ 
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fij FiULOample_e-mail_Fax_Ret:Rived:lxt - Notepad 



To: samuals@ensgtech.con 

From: Electronic Messaging Engines 

Subject: An important alert 

When responding back to this message via the Remote Command Execution (RCE) » please 
use the following message record number: 7688U533 

This message uas sent to: 

ttobilePhone=2149998765, Eroail«saiwals@emsgtech .com, Fax=972999123ii I 
| (forkPhone=2148887766 , Pager-1234567890@alphapage . Windf elt .com 

Server SRU801 is not functioning properly- Please check as soon as possible 
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HI 














| $H RecNum 


: AutoNumber 


i Unique record 


number 






\ ilperlD 


Text 


1 Userid authorized to issue command 




\ HllserlDMame 


iText 


; Name of the person owning this Userid 




\ 3 Password 


:Text 


Password of the userid 






f BSAuthCode 


_^Text 


i Authorization code to match before command can be accepted 




! WA CommandNumber 


Number 


A unique number corresponding to a command in the table 




1 IScommar^Path 


:Text 


: : Location / path where the command can be found on the host 




i iii Host- 


^Text 


) Host where the command is to be executed 
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^ Microsoft Ac. 



_1.'544413BBB ~~ 

...3:SM41 3988 

isSiiSS 

5.6547^2 

6:654789922 

.7:^789922 
8:6547^22 
.£296900781 
10:25^03781 
11. : 266i30781 
12;256900781 
13:9753175K) 
'17:97ST7B80" " 
18.;975317680 

19:97^17^6' 

(AutoNumberi) 



JSANJIV 

;SANJjV 

:SANjiv " 
: NEETU 
NEETU 
: NEETU 

I.SHMJM " 
.iSHfVUM 
...iSHMUM 
.iSHfVUM'' 
/NEIL 
• NEIL 
;NEi 
: NEIL 



;.»000000( 

J;.yyyvyyyvw 
..piiivw'' 

. wwwww 

: ABCDEF" 
: ABCDEF "" " 
: ABCDEF ' "' 
..'.ABCDEF 
;NKAAKN 
;NKAAKN 
: NK^AKN 

"nkaakn 



J987654321 
•;.98765432l' 
.-^54321 
.^7654321'' 
021234567 
.1021234967 
/tK1234567"" 
;&1234567 
.-223344556"' 
223344596 
2233M556 
.223344556 
: 131284131' 
131^4131 
131284131 
131284131 




-J; C-WCE\Diag1.exe ; SRVD01 ' ' 

. ..2i.C:\RCBbi8g2.ixi ."SRvfioT" 

^^Bf^wi_'JsP^ 

4 : .. c J.\RCE\R8boot.exe ".SRytp2 

..1 : C:\RCBDiagi: e xe SRVOOi 

?;■ ?:^CE\Diag2.ex"e " : SRVO01 _ 

l-PjWEWRXsxe^ 

. . *iP : *c|WebooL exe' ; SRVQQ2 

1 i.P;WCBbiagl".exe i SRVD01 

C:\RCE\Diag2.exe : SRVgoT'~ 

3:C:\RCE^TO.exe "Tsftyra 

-.4 •C:\RCE\Reboot.8xV '-SRVOI2 ' 

lift" WCEftCmdl . exe " -SRVoil " 

. . 2; : WC^jagCMCQ^rsI^I 

3 : C :V? CE2\Alert.8'xe : SRyD02 

4:C:\RCEV?eboot.exe SRVTO2 

0 
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DTE_Seruer] 
DTE-1_Seruer=21 6 . 87 -148 .21 0 
Port1=1 001, 1002 
DTE-2_Seruer=216-87.148-211 

Port1=1001 f 1O02 
DTE-3_Serger=216.87. 148.212 
Port2=1 001, 1002 



m 

Wi 

SI 



[AutomaticJEscalation] 

Escalation_Deuice_1=Fax 'f|f 
Escalation_Deuice_2=Email j|| 
Escalation_Deuice_3=Pager |1 
EscalationJ)euice_4=l1obilePhone 
EscalationDeuice 5=WorkPhone 
Escalation_Deuice_6=PamPilot 
Escalation_Deuice_7 i =HomePhone 
Escalation J)euice_8=Future_Deuice 

[IntelligentDecisionMaking] 
AutomaticWakeupTimeCoroputation=ON 
ftutonaticTiiueZoneConiputation=ON 

[Database] 

Databases :\ape1d2\DTE_Client.mdb 

[ProcessRecs] 
Retries=3 
DelRecs=1 
Interual=60 

[License] 

Key-EMSG0000-BR01K2PSNEK-12/31/2O01-11220ENG 

[Logging] 
Mode=N0RMAL 

[Reports] 

REMail=SamUals2000@yahoo.con 
AutoRep=N 
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ft 
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Fig _8_Sample_E-maiLRCE.txt - Notepad 




To : EMME-RBOemsgtech - con 
From: sanwalsQensgtech.com 
Subject: RCE response back 

User id: 54WI3988 
Password: XXXXXXXX 
fiuthCode: 987654321 
MsgRecNun: 76884533 
Connand: 2 



Issuing connand 2. Intend to run Diag2 on SRUQ81. 
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^Mictnxolt Access - [Directory : Tahiti] 



;iB fgj|gp^ 



gijRecNum,. 
Password,.. 
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: A unique ^.record [ number ... 
[Seir^Vusertd (enqipted) 
Iser^.'spass^ 



IsenoVs authojreatl^ 

"ifimW^iiri^ to vtfilch tNs person belongs, 

jMaifing. otWress _ _ 

> Regular e-mail „ 

Tl^te"phone 

*• Horoe Phoney .,„., , , „ 

Mq^^'ZSLil 

JPa^erPin i , - 

- 

3h&£J£W$i -- 

"JFaat NuSber .._ — - 

jP^oi PfrtjM«l 

.'jF^une Messaging .Device 1 _ 

" )Future_^ _ 

Future M^fagin^ Dcytoe 3 .__ 
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